# \[ Creating new rule \]: ERROR Authentication using apikey failed - api key has been invalidated **URL:** \ **Category:** SIEM\ **Tags:** elastic-stack-security, elastic-stack-alerting\ **Created:** [January 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407 "2021-01-18T10:39:12Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [January 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/1 "2021-01-18T10:39:12Z")
Hello, I am using elasticsearch, kibana and beats version 7.10.1 with a Trial license, I am trying to create a new `Match` rule and in my elasticsearch node I am getting this error: ```auto [2021-01-18T11:33:18,032][WARN][o.e.x.s.a.AuthenticationService] [DATA-03] Authentication using apikey failed - api key has been invalidated [2021-01-18T11:33:18,035][WARN][o.e.x.s.a.AuthenticationService] [DATA-03] Authentication using apikey failed - api key has been invalidated ``` and in kibana interface: ```auto Rule failure at Jan 18, 2021 @ 11:33:18.034 Reason: execute Message: [security_exception] missing authentication credentials for REST request [/_security/user/_has_privileges], with { header={ WWW-Authenticate={ 0="Basic realm=\"security\" charset=\"UTF-8\"" & 1="Bearer realm=\"security\"" & 2="ApiKey" } } } ``` ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5f6962d2c16bb757999fb2fca9e3a86b101326b6.png) My rule's configuration is like that: ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d51aa109eb8350542542cc60518a09ea4b9575a0.png) Could you tell me please why I am getting this error ? Thanks ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [January 18, 2021, 4:21pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/2 "2021-01-18T16:21:31Z")
In the current 7.10.x series when a long running rule is still running and you go to update the rule while it is currently running, the API key which represents the rule is invalidated immediately which can result in that rule execution immediately showing an error within that current rule run. The next rule run interval should clear out the error and you should see it run correctly. If on the second rule run it does not clear out and you are consistently seeing this error appear again and again (without editing the rule), then we might have something else we need to investigate deeper. This rule is one of our first rules that can run for a very long time in which case when you modify it while it is currently running, this error shows up for 7.10.x series. But I want to make sure that if you wait for the next interval and the second rule run it does indeed clear out the error message as we expect. The great news here is it looks to have been fixed in the soon to be released 7.11.0 with more advanced ways of deleting API keys: > > > Once the simple invalidation of API keys is resolved (#45144), there will still be some cases that errors may happen and... > If your error does not clear out for some odd reason on the next interval (which I think it really will), then you can re-create a new rule with the same settings from scratch and have that rule execute immediately and should not see this error message at all. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [January 19, 2021, 8:41am UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/3 "2021-01-19T08:41:35Z")
Thanks for your answer @Frank_Hassanabad, so I deleted the rule and created a new one from scrarch and I didn't see that error anymore, I have configured the rule to run every 5 minutes. ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/7/272d4791b367d704c330d6647d4570814effaa5b.png) and I waited like 30 minutes, it has been executed and I see the results, ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1db307aea92d53e44c5496ab034725ea5065db5.png) but It steal display `Going to run` and never display `succeeded` like the other rules ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5ae8571bd0397f5df64eca8e67d4051e09cfccbd.png) Should I just ignore this, or there is something wrong ? Best regards. ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [January 19, 2021, 4:44pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/4 "2021-01-19T16:44:08Z")
`Going to run` constantly being shown is really the rule itself saying, "I am running right now but am taking a long time to run". We have some open tickets for fixing the status of rules to be more clear about them being in the run state vs. in the "going to run" state as that's obviously confusing. If it stays in the "going to run" state for a very long time then that means it is running for a very long period of time which isn't surprising since that does a many to many type of join based query which is going to take a while to run. But it is normal and expected. If you want to break the rule apart using different queries such as querying for a smaller timeframe against your intelligence list that could potentially speed it up but can also have the opposite effect where you end up doing too many queries. But that's kind of up to how you want to tune it when it runs. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [January 19, 2021, 4:53pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/5 "2021-01-19T16:53:45Z")
Thanks for your answer @Frank_Hassanabad, I Think that I am gonna try to break the rule into simple queries (without `OR`), as my cluster went down after 30min running that query, the CPU was at 100% in my 3 data nodes, and went all down ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 16, 2021, 4:53pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407/6 "2021-02-16T16:53:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.